CVE-2025-4225: 
GitLab vulnerability analysis and mitigation

A denial-of-service vulnerability (CVE-2025-4225) was discovered in GitLab CE/EE affecting all versions from 14.1 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1. The vulnerability allows an unauthenticated attacker to cause a denial-of-service condition affecting all users by sending specially crafted GraphQL requests (NVD).

The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). It has received varying CVSS v3.1 severity ratings: NIST assigned a HIGH severity score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), while GitLab Inc. rated it as MEDIUM with a score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) (NVD).

The vulnerability can result in a denial-of-service condition that affects all users of the GitLab instance. The attack can be executed remotely without requiring authentication, potentially disrupting service availability for all GitLab users (NVD).

Users should upgrade to GitLab versions 18.1.5, 18.2.5, or 18.3.1 or later, depending on their current version track. The vulnerability affects all versions from 14.1 up to the specified fixed versions (NVD).